CMS_ADD0_CERT(3ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

✨ CMS_ADD0_CERT(3ossl) ✨

okay bestie, buckle up 💖 this is the 3ossl page for the CMS certificate + CRL utility functions, and honestly it's giving "small but mighty." no cap.

🌸 NAME 🌸

CMS_add0_cert, CMS_add1_cert, CMS_get1_certs, CMS_add0_crl, CMS_add1_crl, CMS_get1_crls — the CMS certificate and CRL utility functions 🎀

🦋 SYNOPSIS 🦋

#include <openssl/cms.h>

int CMS_add0_cert(CMS_ContentInfo *cms, X509 *cert);
int CMS_add1_cert(CMS_ContentInfo *cms, X509 *cert);
STACK_OF(X509) *CMS_get1_certs(CMS_ContentInfo *cms);

int CMS_add0_crl(CMS_ContentInfo *cms, X509_CRL *crl);
int CMS_add1_crl(CMS_ContentInfo *cms, X509_CRL *crl);
STACK_OF(X509_CRL) *CMS_get1_crls(CMS_ContentInfo *cms);

💅 DESCRIPTION 💅

🎀 the cert girlies 🎀

CMS_add0_cert() and CMS_add1_cert() add certificate cert to cms unless it's already present. lowkey polite of them.

this is what CMS_sign_ex(3) and CMS_sign(3) use internally, and you can also call it before CMS_verify(3) to help out with chain building during certificate validation. teamwork makes the dream work 🫶

now, the 0 in the name is load-bearing bestie — as the 0 implies, CMS_add0_cert() adds cert internally to cms, and on success the caller must not free it. it lives there now. it's cms's problem. in contrast, the caller of CMS_add1_cert() must free cert. two very different custody arrangements, don't mix them up 🙈

cms must be of type signed data or (authenticated) enveloped data. for signed data, such a certificate can be used when signing or verifying to fill in the signer certificate, or to provide an extra CA certificate that may be needed for chain building in certificate validation. iconic behaviour, genuinely.

🦋 collecting the certs 🦋

CMS_get1_certs() returns all certificates in cms. all of them. the whole stack.

💜 the CRL chapter 💜

CMS_add0_crl() and CMS_add1_crl() add CRL crl to cms. cms must be of type signed data or (authenticated) enveloped data. for signed data, such a CRL may be used in certificate validation with CMS_verify(3). it may be given both for inclusion when signing a CMS message and when verifying a signed CMS message. versatile queen ✨

CMS_get1_crls() returns all CRLs in cms.

🔥 NOTES 🔥

the CMS_ContentInfo structure cms must be of type signed data or enveloped data or authenticated enveloped data, or an error will be returned. that's the vibe check and it does not negotiate 💀

for signed data, certificates and CRLs are added to the certificates and crls fields of the SignedData structure. for enveloped data they're added to OriginatorInfo. different neighbourhoods, same energy.

⭐ RETURN VALUES ⭐

CMS_add0_cert(), CMS_add1_cert() and CMS_add0_crl() and CMS_add1_crl() return 1 for success and 0 for failure. slay or flop, no in-between 💅

CMS_get1_certs() and CMS_get1_crls() return the STACK of certificates or CRLs, or NULL if there are none or an error occurs. besides out-of-memory, the only error which will occur in practice is if the cms type is invalid. so like, nine times out of ten: check your type bestie 😭

🌈 SEE ALSO 🌈

👑 HISTORY 👑

CMS_add0_cert() and CMS_add1_cert() have been changed in OpenSSL 3.2 not to throw an error if a certificate to be added is already present. glow-up fr fr 🌟

Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, mwah 💋 this was version 3.5.6, dated 2026-04-07, and it's the CMS_ADD0_CERT(3ossl) manual page — go forth and add your certs responsibly, bestie 🧚💜

📦 where this page comes from